Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security

Last updated Jul 25th, 2026

Feed Source

GitHub

Detection Method is

Rule Name & Severity	Author	Last Updated	Labels
Suspicious invoice reference with missing or image-only attachments	Sublime Security	6mo ago Jan 12th, 2026	Credential Phishing Social engineering Content analysis Computer Vision File analysis Natural Language Understanding Sender analysis
Suspicious VBA macros from untrusted sender	Sublime Security	6mo ago Jan 12th, 2026	Malware/Ransomware Macros File analysis Macro analysis Sender analysis
URI protocol handler: search-ms	Sublime Security	6mo ago Jan 12th, 2026	Malware/Ransomware Evasion File analysis HTML analysis
URLhaus: Malicious domain in message body or pdf attachment (trusted reporters)	Sublime Security	6mo ago Jan 12th, 2026	Credential Phishing Malware/Ransomware PDF File analysis Threat intelligence URL analysis
X (Twitter) impersonation with credential phishing motives	Sublime Security	2mo ago May 15th, 2026	Credential Phishing Impersonation: Brand Social engineering Computer Vision File analysis Header analysis Optical Character Recognition Natural Language Understanding Sender analysis

305 Rules

Page 7 of 7